1*c41c5b27SGeorge Karpenkov // RUN: %clang_analyze_cc1 -w -analyzer-checker=core -analyzer-config exploration_strategy=unexplored_first -analyzer-output=text -verify %s
2*c41c5b27SGeorge Karpenkov // RUN: %clang_analyze_cc1 -w -analyzer-checker=core -analyzer-config exploration_strategy=unexplored_first_queue -analyzer-output=text -verify %s
3*c41c5b27SGeorge Karpenkov 
4*c41c5b27SGeorge Karpenkov extern int coin();
5*c41c5b27SGeorge Karpenkov 
foo()6*c41c5b27SGeorge Karpenkov int foo() {
7*c41c5b27SGeorge Karpenkov     int *x = 0; // expected-note {{'x' initialized to a null pointer value}}
8*c41c5b27SGeorge Karpenkov     while (coin()) { // expected-note{{Loop condition is true}}
9*c41c5b27SGeorge Karpenkov         if (coin())  // expected-note {{Taking true branch}}
10*c41c5b27SGeorge Karpenkov                      // expected-note@-1 {{Assuming the condition is true}}
11*c41c5b27SGeorge Karpenkov             return *x; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
12*c41c5b27SGeorge Karpenkov                        // expected-note@-1{{Dereference of null pointer (loaded from variable 'x')}}
13*c41c5b27SGeorge Karpenkov     }
14*c41c5b27SGeorge Karpenkov     return 0;
15*c41c5b27SGeorge Karpenkov }
16*c41c5b27SGeorge Karpenkov 
bar()17*c41c5b27SGeorge Karpenkov void bar() {
18*c41c5b27SGeorge Karpenkov     while(coin())
19*c41c5b27SGeorge Karpenkov         if (coin())
20*c41c5b27SGeorge Karpenkov             foo();
21*c41c5b27SGeorge Karpenkov }
22*c41c5b27SGeorge Karpenkov 
foo2()23*c41c5b27SGeorge Karpenkov int foo2() {
24*c41c5b27SGeorge Karpenkov     int *x = 0; // expected-note {{'x' initialized to a null pointer value}}
25*c41c5b27SGeorge Karpenkov     while (coin()) { // expected-note{{Loop condition is true}}
26*c41c5b27SGeorge Karpenkov         if (coin())  // expected-note {{Taking false branch}}
27*c41c5b27SGeorge Karpenkov                      // expected-note@-1 {{Assuming the condition is false}}
28*c41c5b27SGeorge Karpenkov             return false;
29*c41c5b27SGeorge Karpenkov         else
30*c41c5b27SGeorge Karpenkov             return *x; // expected-warning{{Dereference of null pointer (loaded from variable 'x')}}
31*c41c5b27SGeorge Karpenkov                        // expected-note@-1{{Dereference of null pointer (loaded from variable 'x')}}
32*c41c5b27SGeorge Karpenkov     }
33*c41c5b27SGeorge Karpenkov     return 0;
34*c41c5b27SGeorge Karpenkov }
35*c41c5b27SGeorge Karpenkov 
bar2()36*c41c5b27SGeorge Karpenkov void bar2() {
37*c41c5b27SGeorge Karpenkov     while(coin()) // expected-note{{Loop condition is true}}
38*c41c5b27SGeorge Karpenkov         if (coin()) // expected-note {{Assuming the condition is false}}
39*c41c5b27SGeorge Karpenkov                     // expected-note@-1 {{Taking false branch}}
40*c41c5b27SGeorge Karpenkov           return;
41*c41c5b27SGeorge Karpenkov         else
42*c41c5b27SGeorge Karpenkov             foo(); // expected-note{{Calling 'foo'}}
43*c41c5b27SGeorge Karpenkov }
44